Bearer header
Send the key in theAuthorization request header using the Bearer scheme:
Unauthorized requests
Missing, malformed, or unknown tokens return401 Unauthorized.
Authorization: YOUR_API_KEY. The Bearer prefix is required.
Keep keys safe
- Store keys in environment variables or a managed secret store.
- Call PostlyBee from trusted server-side code, not a public browser bundle.
- Never put keys in URLs, analytics events, screenshots, or support messages.
- Rotate a key immediately if it is exposed.
REST API keys and OAuth-issued MCP access tokens both use the Bearer header,
but they are different credentials and should not be interchanged.